meta-7wx[.]pages[.]dev

Analysis of meta-7wx.pages.dev, first observed on 1 June 2026, indicates an active high‑risk brand‑impersonation campaign targeting MetaMask. The domain is hosted on Cloudflare’s network (IP 172.66.44.56, located in Canada) and uses Cloudflare‑provided nameservers hunts.ns.cloudflare.com and marissa.ns.cloudflare.com. TLS is supplied by Let’s Encrypt (certificate identifier E8) and the site advertises HSTS and HTTP/3 support. The page title returned by the server is “MetaMask | Your Key to Web3”, confirming the intended brand reference. VirusTotal scans show nine of ninety‑one security vendors flag the domain, and it appears on a single blocklist (PhishDestroy). Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. The site returns HTTP 200, indicating a live service. No additional forensic artefacts such as phishing‑kit signatures or payloads have been disclosed; therefore the exact page content remains unverified. Defenders should add the IP address 172.66.44.56 and the domain to network‑level deny lists, enforce DNS filtering for the domain, and monitor for similar Cloudflare‑hosted domains created after June 2026 that reference MetaMask in page titles. Continuous re‑scanning on VirusTotal and other sandboxes is advised to capture any evolving malicious payloads.